Configuration Automation

Establishing the proper span of control for the security baseline is necessary to effectively manage the organization's systems. With single systems, manually managing the security baseline is a relatively simple task, but becomes increasingly complex as different business needs, compliance requirements and configuration items must be managed.

This complexity of managing and applying security baselines has led organizations to implement security baselines through automated tools.

A variety of vendor-supported tools will evaluate a system for compliance with the organization's security baselines and restrict the operation of the system until the baseline has been satisfied.

These management platforms can typically deploy software and patches, ingest configuration changes using the Security Content Automation Protocol and provide comprehensive reporting on the organization's baseline compliance.

Configuration management in cloud environments has evolved as well. Large virtual environments used to rely on "gold images" properly configured and copied as needed.

Unfortunately, image sprawl made this approach unmanageable in enterprise environments. Instead, the provisioning processes and CI/CD promotion of configuration changes into production now ensure the security baselines are consistently deployed in cloud environments.

The organizational change management process tracks the scripts (or "recipes" in the language of one popular tool) as Cls and approves them for deployment.

Provisioning tools then ensure that as new deployments of systems are carried out, they are properly configured using the approved scripts or recipes.

These tools then update the appropriate entries in the configuration management database to show that automated creation (or deployment) of that system was done using a specified, correct, and approved script.